The move from traditional Business Continuity Planning to Operational Resilience is real and growing

I have just finished having an interesting chat with a friend who works in Asia. We discussed how disrupted the world is – and how, in his space, that involves businesses operating for part of the day, with ‘workarounds that recognize your backup generator is not going to get a steady fuel supply etc. It led me to reflect on the following question:

How strong is the move from traditional Business Continuity and RTOs to a focus on Operational Resilience and Impact Tolerance?

Where the shift is strongest

UK financial services: FCA/PRA rules require firms to identify Important Business Services (IBS) and set/validate impact tolerances, making them board‑approved, audited metrics rather than optional add‑ons.[2][4][5][6]
Global large financial institutions and market infrastructures: firms now treat operational resilience as a distinct programme, not “BCM 2.0”, with service‑level testing against impact tolerances.[4][7][8][1]
Tech and cyber‑exposed organizations: newer “ResOps” approaches explicitly map IT assets to critical services and continuously monitor performance against impact tolerances, moving beyond static RTO documentation.[7][9][1]

Focus difference table

[3][6][10][11][1][2][7]

How impact tolerance changes the conversation

RTOs are still used, but as subordinate levers; RTOs are typically set inside the impact tolerance window so that, even after recovery, there is time to clear backlogs and avoid breaching harm thresholds.[6][10][11][1][7]
Impact tolerance reframes the question from “How fast can I recover this function?” to “How much disruption to this service, for whom, over what period, is just tolerable?” and forces explicit articulation of customer and systemic harm.[1][2][3][6][7]
This in turn drives more emphasis on end‑to‑end mapping, third‑party dependencies, and “severe but plausible” scenario testing, which are less prominent in traditional RTO‑centric BCM.[9][2][3][4][1]

Where the shift is weaker or more nominal

Outside regulated finance (e.g. many corporates, public sector), impact tolerance is often adopted as language or a maturity aspiration, while day‑to‑day planning and exercises still revolve around process‑level RTOs and recovery playbooks.[12][2][3][9]
Even in financial services, some organizations struggle to operationalize tolerances, defaulting to relabelled RTOs rather than genuinely service‑level, harm‑based thresholds with monitoring and board challenge.[13][4][7][1]

Practical implication for your practice

For regulated clients, the centre of gravity has clearly moved to impact‑tolerance‑led, service‑centric resilience, with BCM and RTOs nested inside.[2][3][4][7][1]
For others, a hybrid approach is resonating: retain familiar RTOs and BIA, but re‑frame critical outputs as “important services” and translate RTOs into explicit tolerances for customer/ stakeholder harm to build a bridge toward full operational resilience.[8][10][11][7][2]

Our Resilience Review Packages have been third party assessed with the following strengths recognized:

Author: John Salter & Associates Consulting Services

John Salter - specialising in the facilitation of risk-based capability reviews; needs-based training; business continuity planning; crisis management exercises; and organisational debriefing. Recognised for “preventing disasters, or where that is not possible, reducing the potential for harm” Ref: Barrister H Selby, Inquest Handbook, 1998. Distracted by golf, camping, fishing, reading, red wine, movies and theatre. View all posts by John Salter & Associates Consulting Services